# Chrome Extension Search-Hijacking Campaign ("Searchjacked"): 319 Extensions, 13.4M Installs, Queries Proxied via Operator Servers to Bing/Yahoo

> Socket (research by John Tuckner) documented 319 Chrome extensions, with 13.4 million combined installs, that use the chrome_settings_overrides manifest key to replace the default search provider and route every query through operator-controlled proxy/tracking servers before forwarding to Yahoo or Bing for affiliate revenue. The proxy architecture lets operators selectively redirect to phishing pages or malicious downloads; most listed extensions had been removed from the Chrome Web Store by publication.

- **Published:** 2026-10-29T16:20:04Z
- **Last reviewed:** 2026-10-29T16:20:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4753
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4753.png
- **ID:** TL-2026-4753
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Socket's "Searchjacked" report (published 2026-10-29) and BleepingComputer's coverage describe a decade-long (2016-2026) search-hijacking ecosystem consisting of 319 Chrome extensions with roughly 13.4 million combined installs. BleepingComputer reports that 57 of these extensions (about 6 million users) were identified by researcher John Tuckner in April 2025 and that 264 more (about 8.7 million users) were newly identified. Note: the BleepingComputer URL slug says 134 million while the article body and Socket say 13.4 million, and the sub-figures in the article do not sum exactly to 13.4M; the body figure is used here.

Technique: the extensions rely on Chrome's legitimate chrome_settings_overrides manifest key to define a new search provider and make it the default. Socket notes that many extensions need almost no code: a manifest containing only icon files and the chrome_settings_overrides section pointing at an operator domain, with no background service worker and no sensitive permissions. Queries pass through an operator proxy that decides server-side where to send the user: Yahoo (monetized via hspart/hsimp partner parameters), Bing (monetized via PC= partner codes and PTAG= sub-IDs), or other destinations. The Predator Search extension (about 50K users) was observed routing six identical searches to four different destinations, including Yahoo, searchlio.net, searchtosearch.com, and error pages. Because routing is server-side, operators can wait for data to accumulate and then redirect targets to phishing sites or malicious downloads; no such malicious redirection is stated as observed in the sources.

Distribution: extensions masquerade as PDF converters, manual finders, safe search, and AI search tools. Most are unlisted in Chrome Web Store search and reached through pop-over/pop-under and shady website ads (Google Ads, Bidbrain and ad exchanges) leading to single-button landing pages that redirect to the Web Store listing. Socket reports a June 2026 event in which 15 apparently independent publishers pushed coordinated updates within four days using identical Bing tags.

Operators and clusters per Socket: 200 extensions (~5.68M users) were tied to identifiable companies, including Intango LTD (111 extensions, ~2.2M users, 279 domains, Yahoo hspart=iba), Tightrope Interactive (18 extensions, ~122K users), System1, Inc. (9, ~91K), Kinner Lake Ltd (6, ~300K, hspart=flowsurf), Free Planet VPN S.R.L (1, ~2M, hspart=bc), Capital Intellect, Inc. (2, ~50K), and Perion Network/CodeFuel (4, ~50K, hspart=fc), plus BrightWorks Technology LLC, ValidClick/Inuvo, Mutual Media, Vimaok Limited and VPP Technologies. 119 extensions (~7.76M users) had unknown operators, including the SecuryBrowse cluster (58 extensions, ~4.9M users, Bing PC=3QCV/3CGP), the Bing-Search cluster (37 extensions, ~2.2M users, Bidbrain-promoted, PC=3FPX/3VSS), HermesTab (2 extensions, ~400K users, 2017 Yahoo new-tab hijacker) and a Russian-language Yandex search extension (~200K users, active since 2016).

Impact: every search query is visible to the operator and potentially tied to unique identifiers; operators monetize via search-syndication referral revenue and can aggregate trend data. The sources do not report credential theft or code execution, so severity is an analyst judgment of MEDIUM. Removed extensions are being replaced by new domains and lures.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.008 Malvertising
- T1176.001 Browser Extensions
- T1036.005 Match Legitimate Resource Name or Location
- T1557 Adversary-in-the-Middle
- T1090.002 External Proxy
- T1071.001 Web Protocols
- T1565.002 Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Searchjacked - Search Traffic Carrying Operator Yahoo hspart / Bing PC Partner Codes** (`TL-2026-4753-SPL-003`)

Web proxy detection for search URLs carrying the Yahoo hspart partner IDs (iba=Intango LTD, flowsurf=Kinner Lake Ltd, bc=Free Planet VPN S.R.L, fc=Perion/CodeFuel) or the Bing PC partner codes (3QCV/3CGP SecuryBrowse cluster, 3FPX/3VSS Bing-Search cluster) documented in Searchjacked (TL-2026-4753). These monetisation parameters are appended by operator search proxies that sit between the user and Yahoo/Bing, so their presence in a host's search traffic indicates a hijacked default search provider (adversary-in-the-middle on queries). Output lists the destination hosts per client so selective redirection to unexpected destinations is visible.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1557, T1090.002, T1071.001, T1565.002
- **Data sources:** web_proxy, pan:url, zscalernss-web, CommonSecurityLog
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=proxy (sourcetype="pan:url" OR sourcetype="zscalernss-web") earliest=-24h
| eval u=lower(coalesce(url, request_url))."&"
| where match(u, "[?&]hspart=(iba|flowsurf|bc|fc)[^a-z0-9]") OR match(u, "[?&]pc=(3qcv|3cgp|3fpx|3vss)[^a-z0-9]")
| eval partner_param=replace(u, ".*[?&](hspart=[a-z0-9]+|pc=[a-z0-9]+).*", "\1"), dest_host=replace(u, "^(?:https?://)?([^/:?]+).*", "\1")
| stats count as hits dc(dest_host) as distinct_dest_hosts values(dest_host) as dest_hosts values(partner_param) as partner_params min(_time) as first_seen max(_time) as last_seen by src, user
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL matches regex @"(?i)[?&]hspart=(iba|flowsurf|bc|fc)(&|$)" or RequestURL matches regex @"(?i)[?&]pc=(3qcv|3cgp|3fpx|3vss)(&|$)"
| extend PartnerParam = extract(@"(?i)[?&](hspart=[a-z0-9]+|pc=[a-z0-9]+)", 1, RequestURL)
| summarize Hits = count(), DestHosts = make_set(DestinationHostName, 10), PartnerParams = make_set(PartnerParam, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, SourceUserName
```

### Sigma

```yaml
title: Search Request with Searchjacked Yahoo hspart or Bing PC Partner Code
id: e5a2c8f1-6d37-49b0-8c14-3f7a90d2b5e6
status: experimental
description: Detects web proxy requests whose URL carries Yahoo hspart partner IDs or Bing PC partner codes tied by Socket to Searchjacked search-hijacking extension operators (Intango, Kinner Lake, Free Planet VPN, Perion/CodeFuel, SecuryBrowse and Bing-Search clusters). TL-2026-4753.
references:
    - https://socket.dev/blog/searchjacked
    - https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/29
tags:
    - attack.collection
    - attack.t1557
    - attack.command-and-control
    - attack.t1090.002
    - attack.t1071.001
    - attack.impact
    - attack.t1565.002
logsource:
    category: proxy
detection:
    selection_yahoo:
        c-uri|contains:
            - 'hspart=iba'
            - 'hspart=flowsurf'
            - 'hspart=bc&'
            - 'hspart=fc&'
    selection_bing:
        c-uri|contains:
            - 'PC=3QCV'
            - 'PC=3CGP'
            - 'PC=3FPX'
            - 'PC=3VSS'
    condition: selection_yahoo or selection_bing
falsepositives:
    - Legitimate users of products that monetise search through the same partner programs (for example an installed VPN client)
    - Short partner codes such as bc and fc may collide with unrelated Yahoo partners
level: medium
```

**Known false positives:**

- Hosts with a legitimately installed product that uses the same Yahoo/Bing partner programs (e.g. Free Planet VPN client) will match
- Short partner IDs hspart=bc and hspart=fc may overlap with other partners' traffic

**Tuning notes:** Field names (url/request_url, src, user) follow common proxy CIM mappings; map to your proxy's fields. Prioritise hosts where distinct_dest_hosts is above 1, which indicates server-side routing to several destinations as seen with Predator Search. Add newly published hspart/PC codes from Socket and Intango-related research to the patterns.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Searchjacked - Malvertising Ad-Network Hop Followed by Chrome Web Store Extension Page (locked: unlock with TL Creds)
- Searchjacked - Chrome/Edge Preferences File Modified by Non-Browser Process (locked: unlock with TL Creds)
- Searchjacked - Connections to Known Search-Proxy Operator Domains (Proxy and Endpoint) (locked: unlock with TL Creds)
- Searchjacked - Chromium Browser Launched with Side-Loaded Extension Arguments (locked: unlock with TL Creds)
- Searchjacked - External Browser Extension Registered via Registry (update_url / path) (locked: unlock with TL Creds)
- Searchjacked - DNS Resolution of Search-Proxy Operator Domains (locked: unlock with TL Creds)
- Searchjacked - Chrome Extension Manifest Dropped (Known Predator Search ID, Non-Browser Writer or First-Seen Extension) (locked: unlock with TL Creds)
- Searchjacked - Chrome Policy Registry Tampering for Forced Extensions or Default Search Provider (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- Domain: `searchlio[.]net`
- Domain: `searchtosearch[.]com`
- Domain: `mcftink[.]com`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Chrome extensions with 13.4 million installs caught hijacking searches (BleepingComputer, Bill Toulas)](https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/)
- [Searchjacked: 319 extensions hijacking search (Socket)](https://socket.dev/blog/searchjacked)
- [Chrome extensions with 4 million installs (Secure Annex / John Tuckner coverage)](https://tech.yahoo.com/cybersecurity/articles/chrome-extensions-4-million-installs-173548458.html)
- [Chrome Extensions: Overriding Chrome settings (chrome_settings_overrides)](https://developer.chrome.com/extensions/settings_override)
- [BadEx Part I: The Dynamic Search Hijackers (Guardio Labs)](https://guard.io/labs/badex-part-i-the-dynamic-search-hijackers)
- [Looking At Chrome Extensions That Hijack Search - Spread Via Malvertising (Confiant)](https://blog.confiant.com/p/looking-at-chrome-extensions-that)
- [SearchJack: 23 Chrome Extensions Intercept 758,000 Users' Searches (Daily Security Review)](https://dailysecurityreview.com/cyber-security/searchjack-23-chrome-extensions-intercept-758000-users-searches/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4753